Summary
Every second Tuesday of the month, Microsoft releases many security fixes to several of its software solutions. This is known as “Patch Tuesday.” December 2023 was a lighter patch Tuesday than usual, with only a small number of critical vulnerabilities that require patching. Of the 33 vulnerabilities reported, 4 are rated ‘critical’ and 29 ‘important.’
Impact Assessment
Critical vulnerabilities:
- CVE-2023-36019 - Microsoft Power Platform Connector Spoofing Vulnerability
- CVE-2023-35641 - Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
- CVE-2023-35628 - Windows MSHTML Platform Remote Code Execution Vulnerability
- CVE-2023-35630 - Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Notable vulnerabilities:
- CVE-2023-35634 - Windows Bluetooth Driver Remote Code Execution Vulnerability
- CVE-2023-35639 - Microsoft ODBC Driver Remote Code Execution Vulnerability
- CVE-2023-36006 - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
All December 2023 Security updates
These vulnerabilities have the following impact:
Spoofing, Remote Code Execution, Elevation of Privilege, Information Disclosure, and Denial of Service.
Affected Products
Microsoft Power Platform Connector, Windows Internet Connection Sharing (ICS), Windows MSHTML Platform, Windows Cloud Files Mini Filter Driver, Windows Local Security Authority Subsystem Service (LSASS),Microsoft Dynamics ,Microsoft Office Word, Windows Win32K,Chipsets,Azure Machine Learning, Windows Media, Windows Defender, Windows DHCP Server, XAML Diagnostics, Windows DPAPI (Data Protection Application Programming Interface),Windows Telephony Server, Microsoft WDAC OLE DB provider for SQL, Windows ODBC Driver, Windows Kernel-Mode Drivers, Windows USB Mass Storage Class Driver, Windows Kernel, Microsoft Bluetooth Driver, Microsoft Office Outlook, Microsoft Windows DNS. Azure Connected Machine Agent
What it means for you
If you are a regular user of Windows, simply checking your operating system for updates and restarting will be all that must be done. However, if you are part of an organization reviewing the affected products list above for any affected products and reviewing and planning to apply the updates to the environment must be done. Not all updates/fixes to the above products are applied through an OS update, but most are.
Remediation
Checking for updates and restarting endpoints for Microsoft Windows devices. Microsoft server device remediation is different, see the article here on how to upgrade Microsoft server instances.
Most remediations will require a restart of the device after updates are found. For more information about what products are affected and have updates for each vulnerability please refer to the MSRC links and KB articles from Microsoft. Use the following link to search for potential affected products and their associated KB articles. Ensure to select date range and select “Update Tuesday” to search for all relevant KBs and updates.
Business Implications
Microsoft Patch Tuesday provides fixes and remediations for hundreds of vulnerabilities every year. This time, there are no vulnerabilities which require an emergency response. However, it is still important to apply Windows patches promptly. Otherwise, attackers can perform Spoofing, Remote Code Execution, Elevation of Privilege, Information Disclosure, and Denial of Service exploits. The business impact could be monetary, reputational, data, etc. depending on which vulnerability is exploited.
Access Point Technology Recommends
Patch: Patch the Operating Systems of all affected devices and review the affected products list for any other products which could possibly be vulnerable. If so, refer to the MSRC update guide for specific information on patching the vulnerabilities.
Test: Test these patches before launching to all users if you are within an organization. Operating System changes can have a great impact on day-to-day operation.
Rollback: Have a rollback plan in place to ensure that an update will not impact the production environment negatively.
Associated Bulletin
https://msrc.microsoft.com/update-guide/
.webp)
.png)
